Designing Application Permission Models that Meet User Expectations
Franziska Roesner · IEEE Security & Privacy · 2017
How should applications legitimately requiring access to sensitive resources to carry out their functionality be granted access to those resources? The answer to this question depends on users. This article introduces user-driven access control, an alternate permission model that adheres to the principle of least privilege while reducing the burden on users to make explicit permission decisions.